Managing the Permission Validity Period

Notes and Constraints

• Only the DAYU Administrator, Tenant Administrator, and data security administrator can change the permission validity period, configure permission expiration notifications, and operate all notifications. Non-administrator users can operate their subscriptions, but cannot view or operate other users' subscriptions.
• Permission expiration notifications will be sent seven days before the permission expires. The time cannot be changed.
• Expired permissions will be revoked but retained for seven days before they are cleared.
• To configure the permission expiration notifications, you must grant the SMN FullAccess permission of the SMN service to the dlg_agency.

• If a notification topic in DataArts Factory is used for expiration notifications, no notifications will be received because the subscriptions added in DataArts Factory have filtering policies. In this case, you must associate notifications with subscriptions apart from subscribing to notifications so that permission expiration notifications can be received.

• Subscriptions are associated with users through remarks. Subscriptions whose remarks are usernames are regarded as subscriptions of the corresponding users.
• The subscription list is associated a topic. If the topic is changed, you must reconfigure notifications.
• The configured endpoint information cannot be edited. If the phone number or email address changes, delete the endpoint, add it again, and request a subscription again.
• If the user group information for the expiration notification has changed, update the subscription policy so that the correct group information can be received in time.
• A notification is sent everyday for all the permissions that are about to expire. If there are too many permissions that are about to expire, those that will expire sooner will be displayed first. A notification can contain a maximum of 100 records or 200,000 bytes.
• Due to concurrency and SMN performance limitations, SMN notifications may be delayed for a few minutes.

Applying for Short-term Permission

When applying for a permission on the DataArts Security console or Data Map console, you can select the validity period of the permission. You can select a fixed validity period (starting from the application date) or customize the expiration time (24:00 on the expiration day). If you do not set this parameter, the permission will not expire.

After the application is approved, you have the permission within the validity period.

Figure 1 shows the page for applying for a short-term permission on the DataArts Security console.

Figure 1 Filling in the service ticket

Renewing Permissions

You can apply for renewing the permissions that are about to expire if necessary. After the application is approved, the validity period will be extended to the new expiration time.

1. On the DataArts Studio console, locate a workspace and click DataArts Security.
2. In the navigation pane on the left, choose Permission Review. In the right pane, click the My Permissions tab.
3. On the My Permissions page, view the permissions that you have obtained.

   Schedule Job Count is only supported for Hive, Spark, and DLI tables, and is not supported for the inventory data of the jobs using EL expressions or simple variable sets.

   Figure 2 My Permissions page
   

4. Locate a permission and click Renewal in the Operation column to renew the permission, or select permissions and click Batch Renewal above the list to renew the permissions. You can select a fixed validity period (starting from the application date) or customize the expiration time (24:00 on the expiration day).
   Figure 3 Renewing permissions
   

5. Click OK.
6. Check the ticket approval status in the Permission Renewal Status column.

Changing the Validity Period

The administrator can review user permissions and adjust inappropriate validity periods of permissions so that permissions can be updated or revoked in a timely manner.

1. On the DataArts Studio console, locate a workspace and click DataArts Security.
2. In the navigation pane on the left, choose Permission Review. On the Permission Review page, click the Permission Revocation tab.
3. On the Permission Revocation page, view the approved permissions in the current workspace.
   Figure 4 Permission Revocation page
   

4. Locate a permission and click Change Validity Period in the Operation column to change the validity period of the permission, or select permissions and click Change Validity Period above the list to change the validity period of multiple permissions. You can select a fixed validity period (starting from the application date) or customize the expiration time (24:00 on the expiration day).
   Figure 5 Changing the validity period
   

5. Click OK.
6. Check the ticket approval status in the Permission Renewal Status column.

Configuring Permission Expiration Notifications

The administrator can configure the topic and time of the permission expiration notification. Users who have subscribed to the notifications will receive notifications seven days before a permission expires.

1. On the DataArts Studio console, locate a workspace and click DataArts Security.
2. In the navigation pane on the left, choose Permission Review. On the Permission Review page, click the Permission Notifications tab.
3. On the Permission Notifications page, configure a permission expiration notification.
   • Permission Expiration Notification Topic: Select an SMN topic.
   • Permission Expiration Notification Time on Each Day: Select an hour for daily notification.
   • Permission Expiration Notification Workspace Account Management Role: Select the workspace role that will send permission expiration notifications.

Subscribing to Permission Expiration Notifications

After configuring permission expiration notifications, subscribed users will receive notifications seven days before permissions expire.